{"action":"created","issue":{"url":"https://api.github.com/repos/OCA/l10n-france/issues/105","repository_url":"https://api.github.com/repos/OCA/l10n-france","labels_url":"https://api.github.com/repos/OCA/l10n-france/issues/105/labels{/name}","comments_url":"https://api.github.com/repos/OCA/l10n-france/issues/105/comments","events_url":"https://api.github.com/repos/OCA/l10n-france/issues/105/events","html_url":"https://github.com/OCA/l10n-france/issues/105","id":229077843,"number":105,"title":"Reflexion on the french SAPIN LAW application","user":{"login":"flotho","id":1043935,"avatar_url":"https://avatars1.githubusercontent.com/u/1043935?v=4","gravatar_id":"","url":"https://api.github.com/users/flotho","html_url":"https://github.com/flotho","followers_url":"https://api.github.com/users/flotho/followers","following_url":"https://api.github.com/users/flotho/following{/other_user}","gists_url":"https://api.github.com/users/flotho/gists{/gist_id}","starred_url":"https://api.github.com/users/flotho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flotho/subscriptions","organizations_url":"https://api.github.com/users/flotho/orgs","repos_url":"https://api.github.com/users/flotho/repos","events_url":"https://api.github.com/users/flotho/events{/privacy}","received_events_url":"https://api.github.com/users/flotho/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":116,"created_at":"2017-05-16T15:37:47Z","updated_at":"2017-12-18T11:06:16Z","closed_at":null,"author_association":"MEMBER","body":"Dear Community, \r\n\r\nI would like to start a thread regarding the [SAPIN french law](https://www.legifrance.gouv.fr/affichTexteArticle.do?cidTexte=JORFTEXT000031732865&idArticle=LEGIARTI000031734740&dateTexte=20151230). From now the french administration is not really explicit about the ways to certify the Odoo solution. Does anyone has some legal info?\r\n\r\nHere are some of the resources I found :\r\n* http://revuefiduciaire.grouperf.com/article/3661/hb/20160919173548859.html\r\n* https://www.april.org/point-detape-sur-la-nouvelle-reglementation-des-logiciels-de-gestion-et-de-comptabilite\r\n\r\nSome part of the law seems to be easy to certify : Hosting / Backup / Recovery are easy for the community partners to be certified.\r\n\r\nRegarding the durability of the datas I think we have a problem with the POS. From now the POS has been designed to be working without network and all the datas are stored inside the browser database. This point could be an issue if you consider how easy it is to get the datas from the internal database (and what about the debug mode allowing to flush the orders!!!)\r\nI have some little ideas on those points :\r\n* Find a way to block some inappropriate operation from the POS (like in debug mode)\r\n* Find a way to store every transaction in the POSBox from the POS\r\n* Find a way to protect the browser database with encryption\r\n* Find a way to deliver browser application with options preventing the user from acceding to the internal database.\r\n\r\nNone of those solutions looks enough for me(everything in the client part could be changed by an experienced user/ ethic hacker).\r\n \r\nOdoo seems to have started a reflexion on this : https://github.com/odoo-dev/odoo/commits/9.0-l10n_fr-certification-lpe . It looks like Odoo is considering that only the account_cancel module could be a problem.\r\n\r\nSome partners have started a reflexion, (BTW thanks to Sébastien Morelle) : https://anybox.fr/blog/logiciels-de-caisse-certifies\r\n\r\nMaybe we could start a thread here https://odoo-community.org/groups/france-24\r\n\r\nAny feedback would be appreciated.\r\n\r\nRegards"},"comment":{"url":"https://api.github.com/repos/OCA/l10n-france/issues/comments/352395364","html_url":"https://github.com/OCA/l10n-france/issues/105#issuecomment-352395364","issue_url":"https://api.github.com/repos/OCA/l10n-france/issues/105","id":352395364,"user":{"login":"sisalp","id":5159690,"avatar_url":"https://avatars1.githubusercontent.com/u/5159690?v=4","gravatar_id":"","url":"https://api.github.com/users/sisalp","html_url":"https://github.com/sisalp","followers_url":"https://api.github.com/users/sisalp/followers","following_url":"https://api.github.com/users/sisalp/following{/other_user}","gists_url":"https://api.github.com/users/sisalp/gists{/gist_id}","starred_url":"https://api.github.com/users/sisalp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sisalp/subscriptions","organizations_url":"https://api.github.com/users/sisalp/orgs","repos_url":"https://api.github.com/users/sisalp/repos","events_url":"https://api.github.com/users/sisalp/events{/privacy}","received_events_url":"https://api.github.com/users/sisalp/received_events","type":"User","site_admin":false},"created_at":"2017-12-18T11:06:16Z","updated_at":"2017-12-18T11:06:16Z","author_association":"NONE","body":"2017-12-18 10:00 GMT+01:00 fgi-odoo <notifications@github.com>:\n> @sisalp We made sure to comply with every single requirement of the new law.\n> So we are confident in delivering the certificate ourself.\n\nI don't underestimate Odoo's self-confidence but words have their importance.\nWhen you \"certify yourself\", you can deliver an \"attestation\"\nWhen certification is done by an authority (there are two), you get a\ncertified product\n\nApproximation is to be avoided at this step.\n\n> By law it is also\n> forbidden to communicate anything about any certification process.\n>\n\nAny reference to this law ? Certification process is made public by\ncertification authorities. I referenced the main one previously. Do\nyou mean \"certification process results\" instead ?\n\n\nregards\n"}}
{"actor":{"display_login":"sisalp"}}